On 27/08/2010 16:45, Jim Ohlstein wrote:
> On 8/27/10 11:22 AM, Ed W wrote:
>>
>> Create a test file test.jpg as follows:
>> # echo -e "\xff\xd8\xff\xe0\n<?php echo 'hello'; ?>" > test.jpg
>> # file test.jpg
>> test.jpg: JPEG image data
>>
>> Now try and upload this test.jpg file to your server. If it succeeds
>> then probably turn off the server until you fix the issue...
>
> It doesn't work on the apps I mentioned. It simply won't upload.


The apps you mentioned were vBulletin and IPB. I have done a little
more research on this and I believe I can smuggle in the PHP using jpeg
comments. The resulting file should pass all tests as a valid JPG, but
still be executable to the PHP interpreter...

The point is: my expectation is that with a bit of wriggling it should
be possible to find something which should get past your image upload
checks, but your PHP interpreter will still happily process it. If your
server is misconfigured to allow accidental execution of such files then
I think you have a gaping hole in your security... Bottom line is to
*completely disable* execution of all untrusted files (variety of ways
to do that of course)

Personally I don't believe in trusting *only* to the upload filtering to
secure a web application. There is simply too much subtlety here that a
well crafted file should eventually be able to bypass...

Ed W

_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx